Struct Device 

pub struct Device<'a> { /* private fields */ }

Borrowed installation keys, matched against membership before signing.

Implementations

impl<'a> Device<'a>

pub fn seed(seed: &'a SeedAuthority) -> Self

pub fn validate(&self, membership: &Membership) -> Result<()>

pub fn prepare_invitation( &self, membership: &Membership, expiry: u64, ) -> Result<(Invitation, Declaration)>

pub fn prepare_admission( &self, membership: &Membership, declaration: &Declaration, invitation: &Invitation, request: &[u8], keys: &VerifiedKeys, ) -> Result<Vec<u8>>

Prepare once and retain the exact returned bytes before any dispatch. Repreparation is a different candidate, not an exact retry.

impl Device<'_>

pub fn prepare_revoke( &self, m: &Membership, targets: &[[u8; 32]], ) -> Result<Vec<u8>>

Sorted active targets; an empty list requests rotation without removal. Exact bytes must be retained before dispatch. No server commit is implied.

pub fn prepare_rotation_with( &self, m: &Membership, keys: &VerifiedKeys, cutoff: u64, material: &RotationMaterial, ) -> Result<Vec<u8>>

Replay one protected candidate. Encapsulation randomness is bound to the predecessor, signer, and cutoff, so retries are byte-identical while a changed context gets independent HPKE encapsulations. Replacements still require fresh material for independent generation keys.

pub fn receive_rotation( &self, before: &Membership, raw: &[u8], keys: &VerifiedKeys, ) -> Result<VerifiedKeys>

Validates the entire transition and own package before yielding full coverage. Other recipients’ encrypted plaintext cannot be validated by this device.